Delete Route Vulnerability in Gitea Affects Public Organization Repositories

CVE-2026-119441

What is CVE-2026-119441?

A significant access control issue has been identified in Gitea where the DELETE /api/v1/orgs/{org}/repos endpoint allows users with public-only access tokens to delete private repositories within a public organization. The vulnerability arises from the endpoint only verifying that the organization is public, failing to enforce the necessary restriction on the access tokens. This flaw could lead to unintended data loss as public tokens, which should not permit such actions, can allow for critical deletions of private repositories. To mitigate this issue, Gitea has implemented additional checks to reject public-only tokens for operations requiring organization ownership.

References